Admin login from 127.0.0.1 issue

[ShawnZA]

I have been trying to fiugure out what is causing this message in the event logs, there is one every 15 minutes

Administrator admin login failed from http(127.0.0.1) because of invalid password

Now the source is 127.0.0.1, meaning the firewall itself, but I cannot find anything that would be causing it, there was a old script setup to backup the config, deleted the script but still get the message, so it was probably not the backup script, anything else I could check?

I did go through the config and searched for "admin" but nothing in there that would use that username to try and log in

[ShawnZA]

Seems it was the Analyzer causing it, still not sure why it would show source as 127.0.0.1

[le0]

Hello,

I've exactly the same issue.

Login/password from analyser to fortigate are OK.

I've tried to reapply it on the Analyzer (device manager > device > Edit) but nothing change.

When I configure a test login/password on the Analyzer (device manager > device > Edit), I can see the failed authent with this test login so I can confirm this issued is caused by the Analyzer. But why failed authent with correct login/password ..??

[Hosemacht · Accepted solution]

Hello there,

please have a look at thread : https://forum.fortinet.com/tm.aspx?tree=true&m=166591&mpage=1#

Regards